AI Security
6 LLM Security Tools for Protecting AI Applications in 2026
Treat the model reply as untrusted input. A copilot that restates an alert will not stop an app that handed write access to a speaker.
Expertise: AI Security · Level: Intermediate · 6 min read
OWASP LLM05:2025 Improper Output Handling tells you to treat the model as any other user and validate the reply before it reaches a shell, a query, or the browser. The model reply is untrusted input.
Teams still treat the model as a trusted coworker. Rails, scanners, and evals only work if they sit on that zero-trust assumption, not on a hope that the assistant will behave.
The split is a gateway policy in front of the call, a scanner on the prompt and the output, and an eval you run in CI before the next model bump.
Frameworks that try to make the model misbehave belong with the prompt-injection labs on LLM red team tools. Keep the rail on the call you actually ship.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether a tool can fire without an allowlist, whether you host the rail, whether evals live in git, and whether the docs treat model output as untrusted. Garak missed because Promptfoo already covers evals you keep in git, and this page is not a red-team cookbook.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| NeMo Guardrails | Open rails around the call | Colang rails · Apache-2.0 · you host the allowlist |
| LLM Guard | Library that scans prompt and output | Input and output scanners · MIT · library in the app |
| Promptfoo | Evals you keep in git | YAML evals · MIT · CI you already run |
| Lakera | Commercial prompt firewall | API filter · commercial · prompt attack categories |
| Azure AI Content Safety | First-party filter on Azure | Prompt and output filters · Azure consumption · Azure auth |
| Guardrails AI | Validators around structured output | Validators on structured output · Apache-2.0 library / commercial cloud · fail closed |
NeMo Guardrails
Best for open rails around the call
NeMo Guardrails is NVIDIA’s open toolkit. Colang configs define what the bot may say and which tools it may call.
A rail you can read is a rail you can review. You run it on a host you own. You still write the rail. It is not a SOC product.
Key features
- Colang rails
- Input and output rails
- Tool allowlists
- Apache-2.0
Why we like it
A file that names the allowed tools is the control that matches how you actually work when output can call a function.
Limits
You still write the rail. It is not a SOC product. Model quality is a different job.
LLM Guard
Best for library that scans prompt and output
LLM Guard is a Python library of scanners: prompt injection heuristics, PII, toxicity. You call it before and after the model.
When the control must be a function in the request path, a library beats a new SaaS. Heuristics miss. You still treat output as untrusted.
Key features
- Input and output scanners
- MIT
- Composable in an app
- Self-host
Why we like it
A function you can call on the way in and out is the no-new-vendor row.
Limits
Heuristics miss. You still treat output as untrusted. Not a complete MCP gateway.
Promptfoo
Best for evals you keep in git
Promptfoo runs evals. Assertions live next to the prompt. You can fail CI when a rail regresses.
A rail you never evaluate will drift. This is the eval file. An eval is not runtime enforcement, so you still need a rail in the app.
Key features
- YAML evals
- CI friendly
- Red-team style assertions without a cookbook
- MIT
Why we like it
Failing the build when the prompt changes is how the rail stays true.
Limits
An eval is not runtime enforcement. You still need a rail in the app.
Lakera
Best for commercial prompt firewall
Lakera sells Guard for prompt attacks. The familiar commercial option for teams who will not host NeMo.
If procurement already wrote the name, this is that pick. The open rails still matter for the allowlist. A filter is not object-level authorization on the tool.
Key features
- API filter
- Prompt attack categories
- Dashboard
- Commercial
Why we like it
A hosted filter is the commercial path when you will not staff Colang.
Limits
Commercial. A filter is not a tool allowlist.
Azure AI Content Safety
Best for first-party filter on Azure
Azure AI Content Safety is the first-party filter if the model already sits on Azure.
Start with the control in the same cloud as the model. Then add a rail you can grep. Categories are Microsoft’s. It is not an eval repo.
Key features
- Prompt and output filters
- Azure auth
- Categories Microsoft documents
- Consumption price
Why we like it
Using the filter next to the model you already call is the practical first-party start.
Limits
Azure-shaped. Categories are Microsoft’s. Not an eval repo.
Guardrails AI
Best for validators around structured output
Guardrails wraps a call with validators. Structured output that fails a schema does not proceed.
When the model must return JSON your app will execute, a schema that fails closed is the job. A schema is not a tool allowlist. Cloud is paid.
Key features
- Validators
- Structured output
- Open lib
- Cloud option
Why we like it
Refusing JSON that does not match the schema is the right control when the next line executes it.
Limits
A schema is not a tool allowlist. Cloud is paid. You still own the validator set.
What we left out
- Amazon Bedrock Guardrails. Teams already calling Bedrock want the native filter. Azure Content Safety already covers the first-party cloud filter, and a second cloud console would unbalance the list.
- Garak. People want an open LLM vulnerability scanner they can run in CI. Promptfoo already covers evals in git, and this page is rails around the call, not a red-team cookbook.
HN still lands on untrusted output.
Questions before you buy
If a first-party page cannot answer these, keep shopping.
- Can a tool run if it is not on an allowlist I control?
- Where does the rail live if we leave the vendor filter next year?
- What eval fails CI when someone edits the prompt?
Allowlist the function. Keep an assertion next to the prompt. Queue assistants are a different list.
FAQs
Is this the AI SOC list?
No. AI SOC is a copilot on the queue. LLM security covers the app that calls a model.
Does a filter replace tool allowlists?
No. A toxicity filter is the wrong door for a payment tool. Allowlist the function.
Can I skip evals if I bought Lakera?
No. A vendor filter does not prove your rail still holds after a prompt change.
Is this a scored bake-off?
No. Order is editorial. We do not publish jailbreak recipes.
